CVE-2026-44160

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10	Patch
https://github.com/fluent/fluentd/pull/5393	Issue Tracking Patch
https://github.com/fluent/fluentd/releases/tag/v1.19.3	Product Release Notes
https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-08 22:17

Updated : 2026-07-13 18:48

NVD link : CVE-2026-44160

Mitre link : CVE-2026-44160

CVE.ORG link : CVE-2026-44160

JSON object : View

Products Affected

fluentd

fluentd

CWE

CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

{"id": "CVE-2026-44160", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44160", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T19:34:49.901088Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fluent", "product": "fluentd", "versions": [{"status": "affected", "version": "< 1.19.3"}]}]}], "published": "2026-07-08T22:17:14.600", "references": [{"url": "https://github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/pull/5393", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/releases/tag/v1.19.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3."}], "lastModified": "2026-07-13T18:48:13.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AB3C52C-7D3D-4BA5-A8D0-8AC7DA6030EC", "versionEndExcluding": "1.19.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}